From f88fa279bb567c7ff3ab81328ddb94e328110b35 Mon Sep 17 00:00:00 2001
From: Takashi Kajinami <tkajinam@redhat.com>
Date: Wed, 3 Nov 2021 21:06:26 +0900
Subject: [PATCH] Prepare to update default of <service>::wsgi::apache::ssl
Currently the <service>::wsgi::apache::ssl parameters have inconsistent
default values. Some parameters default to true while the other default
to false.
Based on the following points, false is considered to be the more
reasonable default.
- Usage of SSL is optional and is not always required
- There are other methods(like load-balancer) to implement SSL
termination
- Enabling SSL doesn't work with the default values currently
defined, and requires additional parameters like ssl_cert.
- false is the default value defined in the base implementation in
puppet-openstacklib.
This change is the preparation to change the default value, and
introduces a warning message to make users aware of the future change.
Change-Id: I96bae290b599f65b3b03fc5efb8bce3c0459f13a
---
manifests/wsgi/apache.pp | 11 ++++++++---
...prepare-to-change-apache-ssl-dcc2c9a7ec774f5d.yaml | 6 ++++++
2 files changed, 14 insertions(+), 3 deletions(-)
create mode 100644 releasenotes/notes/prepare-to-change-apache-ssl-dcc2c9a7ec774f5d.yaml
diff --git a/manifests/wsgi/apache.pp b/manifests/wsgi/apache.pp
index 352a7d2..aaba784 100644
--- a/manifests/wsgi/apache.pp
+++ b/manifests/wsgi/apache.pp
@@ -101,7 +101,7 @@ class zaqar::wsgi::apache (
$port = 8888,
$bind_host = undef,
$path = '/',
- $ssl = true,
+ $ssl = undef,
$workers = $::os_workers,
$ssl_cert = undef,
$ssl_key = undef,
@@ -119,11 +119,16 @@ class zaqar::wsgi::apache (
$custom_wsgi_process_options = {},
) {
+ if $ssl == undef {
+ warning('Default of the ssl parameter will be changed in a future release')
+ }
+ $ssl_real = pick($ssl, true)
+
include zaqar::deps
include zaqar::params
include apache
include apache::mod::wsgi
- if $ssl {
+ if $ssl_real {
include apache::mod::ssl
}
@@ -134,7 +139,7 @@ class zaqar::wsgi::apache (
path => $path,
priority => $priority,
servername => $servername,
- ssl => $ssl,
+ ssl => $ssl_real,
ssl_ca => $ssl_ca,
ssl_cert => $ssl_cert,
ssl_certs_dir => $ssl_certs_dir,
diff --git a/releasenotes/notes/prepare-to-change-apache-ssl-dcc2c9a7ec774f5d.yaml b/releasenotes/notes/prepare-to-change-apache-ssl-dcc2c9a7ec774f5d.yaml
new file mode 100644
index 0000000..7331493
--- /dev/null
+++ b/releasenotes/notes/prepare-to-change-apache-ssl-dcc2c9a7ec774f5d.yaml
@@ -0,0 +1,6 @@
+---
+upgrade:
+ - |
+ Default value of the ``zaqar::wsgi::apache::ssl`` parameter will be
+ changed from ``true`` to ``false`` in a future release. Make sure
+ the parameter is set to the desired value.